Studio cross-window entity review
Studio consumes the entity-link invocation journal through the same local application as the CLI. This surface adds transport and human controls; it does not define another identity, capacity, admission, or organization state machine.
1. Entry and exact confirmation
The current entity detail has a secondary “Find cross-window identities” drawer. Historical entity revisions cannot open an editable review. Existing library source links lead to the same entity detail; no new top-level navigation is added.
Opening, reading candidates, selecting a candidate, refreshing history, and viewing saved evidence never dispatch a model. The user explicitly selects saved mentions from both windows and enters an API model. Local preview shows the original UUIDs, exact source/revision bindings, selected evidence, workspace, model, endpoint, producer proof and complete system/prompt. Names only retrieve candidates. The currently proven API producer is injected by Studio delivery composition; Codex remains rejected before preparation until its archive bound is proven.
The server stores the complete host preview with its normalized absolute workspace behind an unpredictable token. Propose accepts that token, the same workspace and explicit content confirmation. It never accepts a replacement client plan or summary. The exact host preparation receipt is checked before a start; its locked CAS owns the one dispatch. A previously attempted propose token or an existing prepared review returns its original record without starting; inspect the saved request and explicitly continue instead. A changed workspace, missing confirmation, expired token or unsupported producer cannot authorize sending.
Preview authorizations expire after 30 minutes or a process restart. The service holds at most 224 preview tokens plus one prepared-start token per selected workspace, at most 256 total. Explicit preview discard removes its token; successful cancellation removes that review’s tokens. A newer prepared review replaces obsolete start tokens for the same workspace. The service retains at most 32 application instances and explicitly rejects further workspaces; it never evicts a live instance that might hold an unarchived result. Capacity rejection does not silently create another invocation.
2. Evidence and independent human decision
Persistent list/show return the shared omk.entity-link-invocation-projection/v3 host projection. Human-terminated reviews display their terminal status, human actor and reason without showing identity-acceptance or owner-exit recovery actions. Late results remain evidence only; they cannot reopen admission or organization. Workspace observations use omk.entity-link-quality/v3, showing human terminations and terminated-dispatched counts separately from machine admission and human identity-decision denominators. History and projection come from the same returned snapshot. The interface separately exposes the model assessment, structural admission, human decision, organization result, complete native outcome/failure/refusal, standardized usage and full event history. Unknown counts and costs remain unknown; normalized cache zero is not an assertion that the provider explicitly reported zero.
Accept requires a separate unchecked human identity confirmation and a nonempty reason. Reject requires a nonempty reason and keeps the original history. Accept may provide a new object label; existing object naming remains in the library workflow. Neither model agreement nor a saved organization claims semantic accuracy, quality improvement or verified knowledge. Original source entity UUIDs and knowledge bodies remain separate.
Before acceptance, read accept-preview with the current reason and label. It displays owner head/generation, complete old/new member revisions, mention changes and reasons. Changed existing-member bindings require a separate unchecked evidence-replacement confirmation, independent of same-object identity consent. Editing the reason or label, or inspecting another saved review, clears the preview and this consent. The server still recomputes the digest under lock; browser-supplied old bindings cannot authorize replacement. Unrelated members and historical library revisions retain their original values.
Current kind mismatch and unresolved-identity preflight return the safe codes entity_link_kind_mismatch and entity_link_identity_unresolved. The interface directs users to correct source referent levels or resolve identity respectively; human identity consent cannot override either. Saved conflicts expose the classification version. An old legacy/v1 identity_unresolved is never reclassified from current state. Quality v3 separates organization conflict counts by classification version rather than claiming accuracy changes.
3. Cancellation, unknown acknowledgements and recovery
A prepared invocation can be explicitly continued only after inspecting its saved exact request and confirming content again; the server binds this authorization to workspace, review and generation. Cancellation before start records the human reason. Resume archives a held result or finishes the existing library intent/receipt; it never dispatches. Owner recovery records unknown only after the host proves that the original local process exited. A live or unverifiable owner remains running under that proof-based operation. An explicitly confirmed human may instead use the separate CLI omk observe entity-links terminate after reading the saved execution and owner identities; Studio does not add a terminate mutation or a process-kill control. It can read the resulting terminal fact and prepare an explicit new attempt with retryOf through the existing fresh preview and confirmation flow.
HTTP requests use the existing trusted-origin mutation router, bounded JSON body parser and response-close/server-close abort propagation. Client double clicks share a synchronous request guard; workspace changes and unmount abort outstanding requests and discard late responses. A failed or unreadable mutation acknowledgement retains the same review ID and blocks sending until inspection. Refresh and recovery do not invent new IDs or retry execution. A failed, unknown or human-terminated execution needs a separate explicit new attempt, predecessor review, renewed local preview and confirmation.
Held-result recovery is limited to the same application instance. After a restart without archived bytes, the UI cannot recover the original result by sending again; it displays the durable running/unknown or human-terminated facts. Termination does not prove the original request stopped; unarchived native outcome capacity remains reserved, usage stays unknown, and a late archive never grants identity review. Exceptions exposed by the HTTP adapter use stable safe codes; source text and native evidence render as escaped text.
4. Verification boundary
Controlled loopback HTTP and rendered/lifecycle tests cover transport consent, workspace substitution, one dispatch, raw failure retention, archive recovery, cancellation, stale responses and human controls with zero external/model requests. These checks do not replace production Next/Chrome acceptance after integration, a real human identity decision, a Codex capacity proof or a real-model quality measurement. The outer review journal remains schema 1, with the explicitly versioned termination/review/conflict events and v3 projections described in the journal specification. This event-protocol extension is BREAKING-SCHEMA for earlier readers and remains independent of extraction-run v5. Current entity and knowledge histories remain v2; this surface adds no reader for old extraction runs.